1. Introduction and Data Controller

This Privacy Policy informs visitors and users of business4extroversion.gr (hereinafter referred to as the “Website” or the “Platform”) about the collection, use, storage and other processing of personal data. The Platform operates within the framework of the project “Intermunicipal Actions to Support the Internationalisation of Businesses in Western Athens”, with the Development Association of Western Athens (ASDA) acting as the Contracting Authority. The Data Controller responsible for the processing of personal data is: Development Association of Western Athens (ASDA) 37 Arkadias Street, 12132 Peristeri, Attica, Greece Telephone: +30 210 5745826 Project contact email: extroversion@asda.gr For matters relating to personal data protection and the exercise of relevant rights, users may contact ASDA’s Data Protection Officer (DPO): DPO Email: info@asda.gr The consortium “EEO GROUP S.A. – APOPSI S.A.”, acting as the project’s Contractor, serves as a Data Processor for processing activities carried out on behalf of ASDA, in accordance with ASDA’s instructions and the applicable contractual and legal framework.

2. Legal Framework and Data Processing Principles

Personal data is processed in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR), Greek Law 4624/2019, Greek Law 3471/2006, where applicable, and other relevant legislation. Processing is carried out in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Only personal data that is adequate, relevant and necessary for the specified purposes of the Platform and the project’s activities is collected and processed.

3. Categories of Personal Data

Depending on the services and functionalities used, the Platform may collect and process the following categories of personal data: 3.1. Identification and Contact Details: Full name, email address, telephone number, and the user’s role or position within the business. 3.2. Business and Professional Information: Business name, tax identification number, registered address, business sector, business size, products and services, export activity and target markets, to the extent that such information relates to an identified or identifiable natural person. 3.3. Account and Profile Information: User identifiers, authentication credentials, preferences, activity history and use of available services. 3.4. Application Information: Information, declarations and supporting documents submitted when applying to participate in business missions, international trade fairs, thematic workshops and other project activities. 3.5. State Aid Information: Information required for assessing, documenting and monitoring compliance with the de minimis State aid framework. 3.6. Assessment and Business Support Data: Questionnaire responses, export readiness self-assessment results, business needs, information used for export strategy development, Business Matching and mentoring services. 3.7. Participation Data: Information concerning participation in business missions, trade fairs, B2B meetings, workshops and other activities, including participation evaluation and impact assessment data. 3.8. Communication Preferences: Email addresses and preferences regarding newsletters or other optional communications. 3.9. Technical and Usage Data: IP addresses, device and browser information, system logs and technical data necessary for the secure and proper operation of the Platform. The project does not envisage the systematic collection of health data or other special categories of personal data under Article 9 of the GDPR.

4. Purposes and Legal Bases of Processing

Personal data is processed solely for specified, explicit and lawful purposes related to the operation of the Platform and the implementation of the project. The main purposes of processing include: 4.1. User Account Creation and Management Processing is carried out for user registration, identification, access management and user support. 4.2. Provision of Digital Tools and Business Support Services Processing is carried out to provide export readiness assessment, export strategy development, business intelligence, Business Matching, mentoring and related services. 4.3. Submission, Management and Evaluation of Applications Processing is carried out to receive, review and evaluate applications for participation in business missions, trade fairs and other activities, and to inform applicants about the progress of their applications. 4.4. State Aid Compliance and Monitoring Processing is carried out to perform eligibility checks, manage declarations and comply with obligations arising from the applicable de minimis State aid framework, including Commission Regulation (EU) 2023/2831, where applicable. 4.5. Organisation and Implementation of Activities Processing is carried out to communicate with participants and coordinate business missions, trade fairs, B2B meetings, workshops and other activities. 4.6. Project Monitoring, Evaluation and Reporting Processing is carried out to collect implementation data, evaluate the services provided, prepare reports and fulfil the monitoring, auditing and documentation requirements of the co-funded project. 4.7. Newsletters Processing is carried out to send optional newsletters and communications where the user has provided the relevant consent. 4.8. Security and Technical Operation Processing is carried out to protect information systems, prevent unauthorised access, manage technical incidents and ensure the proper operation of the Platform. Depending on the specific processing purpose and the applicable legal framework, the legal bases may include:

• Article 6(1)(c) GDPR: Compliance with a legal obligation to which the Data Controller is subject, particularly regarding project management, auditing, documentation and State aid obligations.
• Article 6(1)(e) GDPR: Performance of a task carried out in the public interest or in the exercise of official authority, where the relevant processing is supported by the applicable legal framework.
• Article 6(1)(b) GDPR: Performance of a contract or taking steps at the data subject’s request prior to entering into a contract, where the relevant legal requirements are met.
• Article 6(1)(a) GDPR: Consent, particularly for optional newsletters and communications.
• Article 6(1)(f) GDPR: Legitimate interests, only where this legal basis is permitted and lawfully applicable.

The specific legal basis for each processing activity is determined by the nature of the activity, ASDA’s relevant obligations and the applicable legal framework.

5. Automated Processing and Digital Tools

The Platform may use automated mechanisms to perform completeness checks, apply predefined criteria, generate self-assessment results, support Business Matching and personalise the tools and services provided. Certain functionalities may use artificial intelligence technologies to generate personalised information and business support recommendations. Final evaluation and selection of participants for project activities are carried out in accordance with the terms of the relevant Call for Applications and ASDA’s applicable procedures. Where automated decision-making falling within the scope of Article 22 of the GDPR is implemented, the required information is provided and the applicable safeguards and data subject rights are ensured.

6. Recipients of Personal Data

Access to personal data may be granted, strictly to the extent necessary for the performance of the relevant duties, to:

• ASDA and its authorised personnel.
• The Contractor Consortium and authorised members of the Project Team.
• Hosting providers, technical support providers and other data processors or subprocessors.
• Competent managing, auditing and public authorities, in accordance with applicable obligations.
• Organisers of international trade fairs, business missions and cooperating organisations, where the disclosure of specific information is necessary for participation in the relevant activity.
• Participating businesses or potential business partners, exclusively within the framework of business networking services and in accordance with the Platform’s applicable functionalities and access settings.

Access is limited to the data necessary for each purpose and is subject to appropriate protective measures. Personal data is not sold to third parties.

7. Transfers of Personal Data Outside the European Economic Area

In the context of business missions, participation in international trade fairs or other internationalisation activities, limited personal data may need to be transferred to recipients located outside the European Economic Area (EEA). Such transfers take place only where necessary for the relevant purpose and in accordance with Articles 44–49 of the GDPR. Depending on the circumstances, appropriate transfer mechanisms and safeguards are applied, such as European Commission adequacy decisions, appropriate contractual safeguards or specific derogations permitted under the GDPR, provided the relevant legal conditions are met. Users may request further information about the applicable safeguards through the Data Protection Officer’s contact details.

8. Personal Data Retention

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected and processed. Where applicable, personal data is retained for the period required by the legal framework governing the co-funded project, State aid, monitoring and auditing obligations, financial management and the maintenance of the project’s records. Account data, communications, applications, participation records and technical logs are retained according to the relevant processing needs and legal obligations applicable to each category. Once the applicable retention period has expired, personal data is deleted or anonymised unless another lawful reason for its retention exists.

9. Data Subject Rights

Subject to the conditions set out in the GDPR, users have the following rights:

• Right of access to their personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure, where provided by applicable law.
• Right to restriction of processing, subject to the applicable conditions.
• Right to object to certain processing activities.
• Right to data portability, where applicable.
• Right to withdraw consent, where processing is based on consent.
• Rights relating to automated individual decision-making, where Article 22 of the GDPR applies.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. To exercise their rights, users may contact ASDA’s Data Protection Officer: DPO Email: info@asda.gr ASDA reviews and responds to such requests within the time limits established by applicable legislation. Users also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) through its official website: www.dpa.gr.

10. Personal Data Security

ASDA and its data processors implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are designed to ensure the confidentiality, integrity and availability of personal data, taking into account the nature, scope, context and risks of processing. Access to personal data is restricted to authorised individuals according to their responsibilities and operational needs.

11. Cookies and Similar Technologies

The Platform uses cookies and similar technologies for its proper and secure operation and, where applicable, for additional purposes in accordance with users’ consent preferences. Further information regarding cookie categories, purposes, retention periods and available management options is provided in the Platform’s separate Cookie Policy.

12. Updates to This Privacy Policy

ASDA may update this Privacy Policy, particularly in the event of changes to the Platform’s functionalities, services, project activities or applicable legal framework. The current version will be published on this page.